wait4x/blog
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ops): seo-unblock v2——备份出加载路径+主机判定精确 token

Browse Source 
v1 实弹暴露两缺陷：①.bak-seo 备份留在 sites-enabled/ 内被 nginx
glob 加载→duplicate default server 全链崩；②grep -w 词边界点号
之误，git.wait4x.online 也被当博客主站注入 admin location。
v2：备份入 /tmp 专属目录+回滚后清理（含 v1 遗留）+server_name
精确 token 判定。

验证: bash -n 语法过；dry-run 计划段与判定正则复核

Spec: none (脚本热修：v1 事故根因双修)

Co-authored-by: GLM-5.3
This commit is contained in:
wait4xandGLM-5.3 committed 2026-11-01 11:11:27 +08:00
1 parent 50c7595838
commit d41fcc058c
1 file changed
+12 -8
Download Patch File Download Diff File Expand all files Collapse all files
scripts/ops/seo-unblock.sh
+12 -8
View File
@@ -7,6 +7,7 @@
set -euo pipefail set -euo pipefail
SNIPPET=/etc/nginx/snippets/esa-origin-ssl.conf SNIPPET=/etc/nginx/snippets/esa-origin-ssl.conf
BAK="${SNIPPET}.bak-$(date +%s)" BAK="${SNIPPET}.bak-$(date +%s)"
BAKDIR=/tmp/seo-unblock-bak-$(date +%s)
SITES=/etc/nginx/sites-enabled SITES=/etc/nginx/sites-enabled
echo "==== ① 现状 ====" echo "==== ① 现状 ===="
@@ -19,11 +20,11 @@ for f in "$SITES"/*; do
names=$(sudo grep -h "server_name" "$f" 2>/dev/null || true) names=$(sudo grep -h "server_name" "$f" 2>/dev/null || true)
[ -z "$names" ] && continue [ -z "$names" ] && continue
# 内部服务判定：server_name 含内部子域且不含主站裸域 # 内部服务判定：server_name 含内部子域且不含主站裸域
if echo "$names" | grep -qE "(git|api|oj|token|fc|latex|cpa)\.wait4x\.online" && ! echo "$names" | grep -qw "wait4x.online"; then if echo "$names" | grep -qE "(git|api|oj|token|fc|latex|cpa)\.wait4x\.online" && ! echo "$names" | grep -qE "server_name[^;]*(^|[[:space:]])(www\.)?wait4x\.online([[:space:]];|$)" || echo "$names" | grep -qx "server_name wait4x.online;"; then
sudo grep -q "X-Robots-Tag" "$f" || echo " [补回] $f：server 块加 add_header X-Robots-Tag noindex always;" sudo grep -q "X-Robots-Tag" "$f" || echo " [补回] $f：server 块加 add_header X-Robots-Tag noindex always;"
fi fi
# 博客主站判定：server_name 恰含裸域 # 博客主站判定：server_name 恰含裸域
if echo "$names" | grep -qw "wait4x.online"; then if echo "$names" | grep -qE "server_name[^;]*(^|[[:space:]])(www\.)?wait4x\.online([[:space:]];|$)" || echo "$names" | grep -qx "server_name wait4x.online;"; then
sudo grep -q "location /admin/" "$f" || echo " [新增] $f：location /admin/ { noindex }" sudo grep -q "location /admin/" "$f" || echo " [新增] $f：location /admin/ { noindex }"
fi fi
done done
@@ -33,23 +34,24 @@ read -rp ">> 按计划执行？(y/N) " ok; [ "$ok" = "y" ] || { echo "已取消
echo echo
echo "==== ③ 执行 ====" echo "==== ③ 执行 ===="
sudo mkdir -p "$BAKDIR"
sudo cp "$SNIPPET" "$BAK" && echo " 备份：$BAK" sudo cp "$SNIPPET" "$BAK" && echo " 备份：$BAK"
sudo sed -i '/X-Robots-Tag noindex/d' "$SNIPPET" && echo " snippet 已剥 noindex" sudo sed -i '/X-Robots-Tag noindex/d' "$SNIPPET" && echo " snippet 已剥 noindex"
for f in "$SITES"/*; do for f in "$SITES"/*; do
names=$(sudo grep -h "server_name" "$f" 2>/dev/null || true) names=$(sudo grep -h "server_name" "$f" 2>/dev/null || true)
[ -z "$names" ] && continue [ -z "$names" ] && continue
if echo "$names" | grep -qE "(git|api|oj|token|fc|latex|cpa)\.wait4x\.online" && ! echo "$names" | grep -qw "wait4x.online"; then if echo "$names" | grep -qE "(git|api|oj|token|fc|latex|cpa)\.wait4x\.online" && ! echo "$names" | grep -qE "server_name[^;]*(^|[[:space:]])(www\.)?wait4x\.online([[:space:]];|$)" || echo "$names" | grep -qx "server_name wait4x.online;"; then
if ! sudo grep -q "X-Robots-Tag" "$f"; then if ! sudo grep -q "X-Robots-Tag" "$f"; then
sudo cp "$f" "$f.bak-seo" sudo cp "$f" "$BAKDIR/$(basename "$f")"
# 在首个 server_name 行后插入（server 块内、顶层指令位置合法） # 在首个 server_name 行后插入（server 块内、顶层指令位置合法）
sudo sed -i "0,/server_name/s/\(server_name.*\)/\1\n add_header X-Robots-Tag noindex always;/" "$f" sudo sed -i "0,/server_name/s/\(server_name.*\)/\1\n add_header X-Robots-Tag noindex always;/" "$f"
echo " 补回：$f" echo " 补回：$f"
fi fi
fi fi
if echo "$names" | grep -qw "wait4x.online"; then if echo "$names" | grep -qE "server_name[^;]*(^|[[:space:]])(www\.)?wait4x\.online([[:space:]];|$)" || echo "$names" | grep -qx "server_name wait4x.online;"; then
if ! sudo grep -q "location /admin/" "$f"; then if ! sudo grep -q "location /admin/" "$f"; then
sudo cp "$f" "$f.bak-seo" 2>/dev/null || sudo cp "$f" "$f.bak-seo" sudo cp "$f" "$BAKDIR/$(basename "$f")"
sudo sed -i "0,/server_name/s/\(server_name.*\)/\1\n location \/admin\/ { add_header X-Robots-Tag noindex always; }/" "$f" sudo sed -i "0,/server_name/s/\(server_name.*\)/\1\n location \/admin\/ { add_header X-Robots-Tag noindex always; }/" "$f"
echo " admin 局部：$f" echo " admin 局部：$f"
fi fi
@@ -61,9 +63,11 @@ echo "==== ④ 语法检查+重载（失败自动回滚）===="
if ! sudo nginx -t; then if ! sudo nginx -t; then
echo "!! nginx -t 失败，回滚全部改动" echo "!! nginx -t 失败，回滚全部改动"
sudo cp "$BAK" "$SNIPPET" sudo cp "$BAK" "$SNIPPET"
for f in "$SITES"/*.bak-seo; do for f in "$BAKDIR"/*; do
[ -f "$f" ] && sudo cp "$f" "${f%.bak-seo}" [ -f "$f" ] && sudo cp "$f" "$SITES/$(basename "$f")"
done done
sudo rm -rf "$BAKDIR"
sudo rm -f "$SITES"/*.bak-seo # v1 遗留备份也在加载路径上，一并清掉
sudo nginx -t && sudo systemctl reload nginx sudo nginx -t && sudo systemctl reload nginx
echo "已回滚，请把以上报错发给 research 人工处理"; exit 1 echo "已回滚，请把以上报错发给 research 人工处理"; exit 1
fi fi